Java层热修复框架实践

结合上一篇研究的内容，我们在这一篇实现一个简单的HotFix框架。

上一篇有一个重要的内容没有讲，就是在实现方法的替换后，原来的方法中的内存就会被覆盖，如果我们还想要调用原来的方法怎么办呢？所以我们需要找个地方把原来的方法存起来，不过在具体实现的时候，会遇到一个问题，就是 Java的非static，非private的方法默认是虚方法，在调用这个方法的时候会有一个类似查找虚函数表的过程：

mirror::Object* receiver = nullptr;
if (!m->IsStatic()) {
  // Check that the receiver is non-null and an instance of the field's declaring class.
  receiver = soa.Decode<mirror::Object*>(javaReceiver);
  if (!VerifyObjectIsClass(receiver, declaring_class)) {
    return NULL;
  }

  // Find the actual implementation of the virtual method.
  m = receiver->GetClass()->FindVirtualMethodForVirtualOrInterface(m);
}

在调用的时候，如果不是static的方法，会去查找这个方法的真正实现；我们直接把原方法做了备份之后，去调用备份的那个方法，如果此方法是public的，则会查找到原来的那个函数，于是就无限循环了；我们只需要阻止这个过程，查看 FindVirtualMethodForVirtualOrInterface 这个方法的实现就知道，只要方法是 invoke-direct 进行调用的，就会直接返回原方法，这些方法包括：构造函数，private的方法(见https://source.android.com/devices/tech/dalvik/dalvik-bytecode.html) 因此，我们手动把这个备份的方法属性修改为private即可解决这个问题。
核心问题都解决了，下面我们把这些内容整合到一个HotFix的核心类中：

package com.amuro.hotfix;

import android.os.Build;
import android.util.Pair;

import java.lang.reflect.AccessibleObject;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.nio.Buffer;
import java.nio.ByteBuffer;
import java.nio.ByteOrder;
import java.util.Map;
import java.util.concurrent.ConcurrentHashMap;

/**
 * Created by Amuro on 2017/9/27.
 */
public class Hotfix
{
    private static class Memory
    {

        static byte peekByte(long address)
        {
            return (Byte) ReflectUtils.invokeStaticMethod(
                    "libcore.io.Memory", "peekByte", new Class[]{long.class}, new Object[]{address}
            );

        }

        static void pokeByte(long address, byte value)
        {
            ReflectUtils.invokeStaticMethod(
                    "libcore.io.Memory", "pokeByte",
                    new Class[]{long.class, byte.class}, new Object[]{address, value}
            );

        }

        static void memcpy(long dst, long src, long length)
        {
            for (long i = 0; i < length; i++)
            {
                pokeByte(dst, peekByte(src));
                dst++;
                src++;
            }
        }
    }

    private static class Unsafe
    {
        static final String UNSAFE_CLASS_NAME = "sun.misc.Unsafe";
        static Object UNSAFE_CLASS_INSTANCE =
                ReflectUtils.getStaticFieldObj(UNSAFE_CLASS_NAME, "THE_ONE");

        static long getObjectAddress(Object obj)
        {
            Object[] args = {obj};

            Integer baseOffset = (Integer) ReflectUtils.invokeMethod(
                    UNSAFE_CLASS_NAME, UNSAFE_CLASS_INSTANCE, "arrayBaseOffset",
                    new Class[]{Class.class}, new Object[]{Object[].class}
            );

            long result = ((Number) ReflectUtils.invokeMethod(
                    UNSAFE_CLASS_NAME, UNSAFE_CLASS_INSTANCE, "getInt",
                    new Class[]{Object.class, long.class}, new Object[]{args, baseOffset.longValue()}
            )).longValue();

            return result;
        }

    }

    private static class MethodDecoder
    {
        static long sMethodSize = -1;

        public static void ruler1()
        {
        }

        public static void ruler2()
        {
        }

        static long getMethodAddress(Method method)
        {

            Object mirrorMethod =
                    ReflectUtils.getFieldObj(
                            Method.class.getSuperclass().getName(), method, "artMethod"
                    );
            if (mirrorMethod.getClass().equals(Long.class))
            {
                return (Long) mirrorMethod;
            }

            return Unsafe.getObjectAddress(mirrorMethod);
        }

        static long getArtMethodSize()
        {
            if (sMethodSize > 0)
            {
                return sMethodSize;
            }

            try
            {
                Method m1 = MethodDecoder.class.getDeclaredMethod("ruler1");
                Method m2 = MethodDecoder.class.getDeclaredMethod("ruler2");

                sMethodSize = getMethodAddress(m2) - getMethodAddress(m1);
            }
            catch (Exception e)
            {
                e.printStackTrace();
            }

            return sMethodSize;
        }
    }

    private static Map<Pair<String, String>, Method> sBackups = new ConcurrentHashMap<>();

    protected static void hook(Method origin, Method replace)
    {
        // 1. backup
        Method backUpMethod = backUp(origin, replace);
        sBackups.put(
                Pair.create(replace.getDeclaringClass().getName(), replace.getName()),
                backUpMethod
        );

        // 2. replace method
        long addressOrigin = MethodDecoder.getMethodAddress(origin);
        long addressReplace = MethodDecoder.getMethodAddress(replace);
        Memory.memcpy(
                addressOrigin,
                addressReplace,
                MethodDecoder.getArtMethodSize());
    }

    protected static Object callOrigin(Object receiver, Object... params)
    {
        StackTraceElement[] stackTrace = Thread.currentThread().getStackTrace();
        StackTraceElement currentStack = stackTrace[4];
        Method method = sBackups.get(
                Pair.create(currentStack.getClassName(), currentStack.getMethodName()));

        try
        {
            return method.invoke(receiver, params);
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }

        return null;
    }

    private static Method backUp(Method origin, Method replace)
    {
        try
        {
            if (Build.VERSION.SDK_INT < 23)
            {
                Class<?> artMethodClass = Class.forName("java.lang.reflect.ArtMethod");
                Field accessFlagsField = artMethodClass.getDeclaredField("accessFlags");
                accessFlagsField.setAccessible(true);

                Constructor<?> artMethodConstructor = artMethodClass.getDeclaredConstructor();
                artMethodConstructor.setAccessible(true);
                Object newArtMethod = artMethodConstructor.newInstance();

                Constructor<Method> methodConstructor =
                        Method.class.getDeclaredConstructor(artMethodClass);
                Method newMethod = methodConstructor.newInstance(newArtMethod);
                newMethod.setAccessible(true);

                Memory.memcpy(MethodDecoder.getMethodAddress(newMethod),
                        MethodDecoder.getMethodAddress(origin),
                        MethodDecoder.getArtMethodSize());

                Integer accessFlags = (Integer) accessFlagsField.get(newArtMethod);
                accessFlags &= ~Modifier.PUBLIC;
                accessFlags |= Modifier.PRIVATE;
                accessFlagsField.set(newArtMethod, accessFlags);

                return newMethod;
            }
            else
            {
                // AbstractMethod
                Class<?> abstractMethodClass = Method.class.getSuperclass();
                Field accessFlagsField = abstractMethodClass.getDeclaredField("accessFlags");
                Field artMethodField = abstractMethodClass.getDeclaredField("artMethod");
                accessFlagsField.setAccessible(true);
                artMethodField.setAccessible(true);

                // make the construct accessible, we can not just use `setAccessible`
                Constructor<Method> methodConstructor = Method.class.getDeclaredConstructor();
                Field override = AccessibleObject.class.getDeclaredField(
                        Build.VERSION.SDK_INT == Build.VERSION_CODES.M ? "flag" : "override");
                override.setAccessible(true);
                override.set(methodConstructor, true);

                // clone the origin method
                Method newMethod = methodConstructor.newInstance();
                newMethod.setAccessible(true);
                for (Field field : abstractMethodClass.getDeclaredFields())
                {
                    field.setAccessible(true);
                    field.set(newMethod, field.get(origin));
                }

                // allocate new artMethod struct, we can not use memory managed by JVM
                int artMethodSize = (int) MethodDecoder.getArtMethodSize();
                ByteBuffer artMethod = ByteBuffer.allocateDirect(artMethodSize);
                Long artMethodAddress;
                int ACC_FLAG_OFFSET;
                if (Build.VERSION.SDK_INT < 24)
                {
                    // Below Android N, the jdk implementation is not openjdk
                    artMethodAddress =
                            (Long) ReflectUtils.getFieldObj(
                                    Buffer.class.getName(), artMethod, "effectiveDirectAddress"
                            );

                    // http://androidxref.com/6.0.0_r1/xref/art/runtime/art_method.h
                    // GCRoot * 3, sizeof(GCRoot) = sizeof(mirror::CompressedReference) = sizeof(mirror::ObjectReference) = sizeof(uint32_t) = 4
                    ACC_FLAG_OFFSET = 12;
                }
                else
                {
                    artMethodAddress =
                            (Long) ReflectUtils.invokeMethod(
                                    artMethod.getClass().getName(), artMethod, "address", null, null
                            );

//                            (Long) Reflection.call(artMethod.getClass(), null, "address", artMethod, null, null);

                    // http://androidxref.com/7.0.0_r1/xref/art/runtime/art_method.h
                    // sizeof(GCRoot) = 4
                    ACC_FLAG_OFFSET = 4;
                }
                Memory.memcpy(
                        artMethodAddress, MethodDecoder.getMethodAddress(origin), artMethodSize);

                byte[] newMethodBytes = new byte[artMethodSize];
                artMethod.get(newMethodBytes);
                // replace the artMethod of our new method
                artMethodField.set(newMethod, artMethodAddress);

                // modify the access flag of the new method
                Integer accessFlags = (Integer) accessFlagsField.get(origin);
                int privateAccFlag = accessFlags & ~Modifier.PUBLIC | Modifier.PRIVATE;
                accessFlagsField.set(newMethod, privateAccFlag);

                // 1. try big endian
                artMethod.order(ByteOrder.BIG_ENDIAN);
                int nativeAccFlags = artMethod.getInt(ACC_FLAG_OFFSET);
                if (nativeAccFlags == accessFlags)
                {
                    // hit!
                    artMethod.putInt(ACC_FLAG_OFFSET, privateAccFlag);
                }
                else
                {
                    // 2. try little endian
                    artMethod.order(ByteOrder.LITTLE_ENDIAN);
                    nativeAccFlags = artMethod.getInt(ACC_FLAG_OFFSET);
                    if (nativeAccFlags == accessFlags)
                    {
                        artMethod.putInt(ACC_FLAG_OFFSET, privateAccFlag);
                    }
                    else
                    {
                        // the offset is error!
                        throw new RuntimeException("native set access flags error!");
                    }
                }

                return newMethod;

            }
        }
        catch (Exception e)
        {
            return null;
        }
    }
}

这里最复杂的就是backup方法了，主要就是把原来method的public属性改成private的，避免上述的死循环问题。感兴趣的童鞋可以去翻Method的父类AbstractMethod的源码，大量的反射都来自源码的阅读理解。

好了，核心的工具类搞定了，下面就是怎么弄出我们的补丁和加载补丁了。之前我们分析AndFix的补丁知道，AndFix的补丁本质就是配置文件加一个dex文件，这个dex的本质可以总结为以下两点：
1.在两个apk对比时AndFix找到了方法发生变动的某个类，这里设有问题的类是A，patch后的是B，但两者的名字是一模一样的；
2.按照一定的命名规则把B中的类名做一个修改，然后找到发生变化的方法，在方法上加上注解；
3.把这些被修改过的类做成一个dex文件。
知道了补丁的本质，我们也可以手工写出这样的补丁类，然后自己打包成dex用就可以了，这里举个例子，先写个有问题的类：
注意包名是cn.cmgame.demo。

package cn.cmgame.demo;

import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.view.View;
import android.widget.TextView;
import android.widget.Toast;

import com.amuro.hotfix.HotfixManager;

public class MainActivity extends AppCompatActivity
{

    @Override
    protected void onCreate(Bundle savedInstanceState)
    {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        findViewById(R.id.bt_mk_bug).setOnClickListener(new View.OnClickListener()
        {
            @Override
            public void onClick(View v)
            {
                callBug();
            }
        });

        findViewById(R.id.bt_fix_bug).setOnClickListener(new View.OnClickListener()
        {
            @Override
            public void onClick(View v)
            {
                doFix();
            }
        });


    }

    private void callBug()
    {
        showToast("I'm a bug");
    }

    private void doFix()
    {
        try
        {
            HotfixManager.getInstance().init(this);
            HotfixManager.getInstance().fix();

        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    private void showToast(String msg)
    {
        Toast.makeText(this, msg, Toast.LENGTH_SHORT).show();
    }

}

然后我们自己定义一个规则写一个补丁类，我这里的规则是原包名下加一个fix包，类名加一个_FIX后缀，然后仿照AndFix写一个要被replace的注解：

package com.amuro.hotfix;

/**
 * Created by Amuro on 2017/9/29.
 */

public @interface MethodReplace
{
    String className();
    String methodName();
}

万事俱备，我们可以把这个补丁类写出来了：

package cn.cmgame.demo.fix;

import android.os.Bundle;
import android.support.v7.app.AppCompatActivity;
import android.view.View;
import android.widget.Toast;

import com.amuro.hotfix.HotfixManager;
import com.amuro.hotfix.MethodReplace;

import cn.cmgame.demo.R;

public class MainActivity_FIX extends AppCompatActivity
{

    @Override
    protected void onCreate(Bundle savedInstanceState)
    {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        findViewById(R.id.bt_mk_bug).setOnClickListener(new View.OnClickListener()
        {
            @Override
            public void onClick(View v)
            {
                callBug();
            }
        });

        findViewById(R.id.bt_fix_bug).setOnClickListener(new View.OnClickListener()
        {
            @Override
            public void onClick(View v)
            {
                doFix();
            }
        });


    }

    @MethodReplace(className = "cn.cmgame.demo.MainActivity", methodName = "callBug")
    private void callBug()
    {
        showToast("bug has been fixed");
        HotfixManager.getInstance().callOrigin(this, new Object[]{});
    }

    private void doFix()
    {
        try
        {
            HotfixManager.getInstance().init(this);
            HotfixManager.getInstance().fix();

        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    private void showToast(String msg)
    {
        Toast.makeText(this, msg, Toast.LENGTH_SHORT).show();
    }

}

编译生成class文件，提取这个文件用dx工具打成dex文件，我们的补丁文件就ok了，下面就是怎么加载这个补丁了，这里我们要用到插件化中的动态加载技术，不太熟的同学可以找我之前的blog看，这里不再赘述。根据框架的设计原则，我们也封装了一个外观类：

package com.amuro.hotfix;

import android.content.Context;
import android.os.Environment;

import java.io.File;
import java.io.IOException;
import java.lang.reflect.Array;
import java.lang.reflect.Method;
import java.util.Enumeration;

import dalvik.system.DexClassLoader;
import dalvik.system.DexFile;

/**
 * Created by Amuro on 2017/9/28.
 */

public class HotfixManager
{
    private HotfixManager(){}

    private static HotfixManager instance = new HotfixManager();

    public static HotfixManager getInstance()
    {
        return instance;
    }

    private static final String SD_CARD_PATH =
            Environment.getExternalStorageDirectory().getAbsolutePath();
    private static final String PATCH_PATH = "sdk_patch";

    private Context appContext;
    private DexClassLoader patchClassLoader;
    private DexFile[] dexFiles;

    public void init(Context context)
    {
        this.appContext = context.getApplicationContext();

        try
        {

            File patchDir =
                    FileUtil.getDir(SD_CARD_PATH + File.separator + PATCH_PATH);
            String dexPath =
                    patchDir.getAbsolutePath() + File.separator + "patch.jar";
            File optDir =
                    FileUtil.getDir(appContext.getCacheDir().getAbsolutePath() +
                            File.separator + "patch/opt"
                    );
            File soDir =
                    FileUtil.getDir(appContext.getCacheDir().getAbsolutePath() +
                            File.separator + "patch/so"
                    );


            patchClassLoader = new DexClassLoader(
                    dexPath,
                    optDir.getAbsolutePath(),
                    soDir.getAbsolutePath(),
                    appContext.getClassLoader());

            //reflect the dexFile for traverse all of the class in the patch
            Object dexPathList = ReflectUtils.getFieldObj(
                    "dalvik.system.BaseDexClassLoader", patchClassLoader, "pathList");
            Object dexElements = ReflectUtils.getFieldObj(
                    "dalvik.system.DexPathList", dexPathList, "dexElements");

            int length = Array.getLength(dexElements);
            dexFiles = new DexFile[length];
            for(int i = 0; i < length; i++)
            {
                Object element = Array.get(dexElements, i);

                dexFiles[i] = (DexFile) ReflectUtils.getFieldObj(
                    "dalvik.system.DexPathList$Element", element, "dexFile"
                );
            }
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }

    }

    public void fix()
    {
        try
        {
            //traverse the dexFile and hook all of the methods
            for(DexFile dexFile : dexFiles)
            {

                Enumeration<String> entries = dexFile.entries();
                Class<?> clazz = null;
                while (entries.hasMoreElements())
                {
                    String entry = entries.nextElement();

                    clazz = dexFile.loadClass(entry, patchClassLoader);
                    if (clazz != null)
                    {
                        Method[] methods = clazz.getDeclaredMethods();
                        for (Method replace : methods)
                        {
                            MethodReplace mr =
                                    replace.getAnnotation(MethodReplace.class);
                            if (mr == null)
                            {
                                continue;
                            }

                            Method origin =
                                    Class.forName(mr.className()).getDeclaredMethod(mr.methodName(),
                                            replace.getParameterTypes());

                            Hotfix.hook(origin, replace);
                        }

                    }
                }
            }
        }
        catch (Exception e)
        {
            e.printStackTrace();
        }
    }

    public void callOrigin(Object receiver, Object[] params)
    {
        Hotfix.callOrigin(receiver, params);
    }
}

这里用到了一点别的东西，因为我们要遍历出补丁中所有的类，classLoader本身没有开放这个api，所以需要阅读一下BaseDexClassLoader的源码，从中找到具备这个能力的DexFile类文件，实现这个功能，具体的请参考代码中的注释。遍历类的时候，通过反射获取加了注解的方法，然后从中取出原来的方法进行backup和替换。
好了，一个简单的热修复框架就完成了，这里还没有对签名做处理，具体的可以直接复用AndFix的源码，对于sdk来说，没有so就可以大大增加兼容性，减小集成的难度。当然这里只是抛砖引玉，真正要做一个商用的热修复框架需要解决的问题还有很多很多，而且目前的框架只能实现方法级的替换，对于资源等其他大量内容无法实现修复，局限性很大，这块研究我还会继续深入下去，感谢大家收看。